DarkSingularity/KeepItGoingServer
Internal
Public Access
2
0
Fork 0
Code Issues 3 Pull Requests Packages Projects Releases 1 Wiki Activity
18 Commits 1 Branch 3 Tags
e5b15c7193a700779071f538a45391b346f29ab5
Commit Graph
6 Commits
Author SHA1 Message Date
Keith SmithandClaude Sonnet 4.5 0147b8644e Add tasks.firebugit.com to development server configuration 
Added tasks.firebugit.com to:
- ALLOWED_HOSTS: Allow Django to serve requests from this domain
- CSRF_TRUSTED_ORIGINS: Allow CSRF-protected requests from https://tasks.firebugit.com

This enables testing the development server via the tasks.firebugit.com domain.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
 2025-12-23 06:08:39 -07:00
Keith SmithandClaude Sonnet 4.5 deabe6ab3d Fix Critical Security Issue: Implement rate limiting on API endpoints 
Added comprehensive rate limiting to prevent abuse and DoS attacks:

Configuration (config/settings/base.py):
- Anon rate: 100 requests/hour for anonymous users
- User rate: 1000 requests/hour for authenticated users
- Login rate: 10 attempts/hour (prevents brute force)
- Register rate: 5 attempts/hour (prevents account spam)
- Sync rate: 100 requests/hour (prevents sync flooding)

Custom throttle classes (users/throttles.py):
- LoginRateThrottle: Strict limit for login endpoint
- RegisterRateThrottle: Strict limit for registration endpoint
- SyncRateThrottle: Moderate limit for sync endpoint

Applied throttling to sensitive endpoints:
- users.views.RegisterAPIView: 5/hour
- users.views.TokenObtainPairView: 10/hour
- sync.views.sync: 100/hour

All other API endpoints use default throttles (anon: 100/hour, user: 1000/hour).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
 2025-12-22 22:36:54 -07:00
Keith SmithandClaude Sonnet 4.5 b57321e1e4 Fix Critical Security Issue: Replace print() with proper logging 
Replaced all debug print() statements with proper logging framework:
- tasks/views.py: 5 print statements → logger.debug()
- sync/views.py: 15 print statements → logger.debug()
- config/celery.py: 1 print statement → logger.debug()
- notifications/tasks.py: 2 print statements → logger.error()

Retained print() in settings files (development.py, selfhosted.py) as they are appropriate warnings to stderr for configuration issues.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
 2025-12-22 22:34:57 -07:00
Keith SmithandClaude Sonnet 4.5 a22c3eed50 Fix Critical Security Issue: Remove weak default SECRET_KEY 
Security improvements:
- selfhosted.py: Require SECRET_KEY environment variable (raises ValueError if not set)
- selfhosted.py: Validate SECRET_KEY length (minimum 50 characters)
- selfhosted.py: Warn if DEBUG=True in self-hosted mode
- development.py: Auto-generate random SECRET_KEY on each startup if not provided
- development.py: Remove production domain from ALLOWED_HOSTS
- development.py: Make CSRF_TRUSTED_ORIGINS environment-only

This prevents weak/default SECRET_KEYs from being used in production.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
 2025-12-22 22:31:46 -07:00
Keith SmithandClaude Sonnet 4.5 21d9d01885 Add email verification, admin approval, and user profile enhancements 
Implement comprehensive email verification and admin approval system for user registration. Users must verify their email before logging in, and admins must approve new users before they can access the system.

Major features:
- Email verification with UUID tokens (24hr expiry, one-time use)
- Admin approval workflow via Django admin interface
- Custom authentication backend enforcing verification and approval
- Password change functionality for authenticated users
- Enhanced profile page with proper styling and theme support
- Collect first name, last name, and timezone during registration
- Profile link added to header navigation

Email notifications:
- Verification email sent after registration
- Admin notification when users need approval
- Approval notification sent to users

Security features:
- Cryptographically secure UUID tokens
- Token expiration and one-time use enforcement
- Email enumeration protection
- Custom JWT token validation for API access
- Existing users auto-approved via data migration

Templates added:
- Email templates (verification, approval, admin notification)
- Web templates (password change, verification pages)
- Enhanced profile page with dark/light mode support

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
 2025-12-22 18:13:38 -07:00
Keith SmithandClaude Sonnet 4.5 6a0b35c39c Initial commit: KeepItGoing task management server 
Features:
- Django-based REST API with web interface
- Task management with tags, priorities, and due dates
- Time tracking with start/stop timers
- Subtasks support
- Task filtering (all, today, upcoming, overdue, completed)
- Tag-based organization with color coding
- Sorting by due date and priority
- Auto-assign tags when filtering
- Responsive 3-pane layout (sidebar, task list, detail panel)
- Task sharing between users
- Mobile-responsive design with dark mode support

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
 2025-12-18 17:41:29 -07:00